"Google and Meta, Accused of Leaking Personal Information, Should Undergo Additional Investigation for Further Offenses"

Citizen Groups Report Google and Meta to Personal Information Protection Commission
"There Are Other Privacy Violations Beyond the 100 Billion KRW Fine"
Personal Data Sold at Auction, Information Leaked Even to Unsuccessful Bidders

[Asia Economy Reporter Seungjin Lee] Amid Google and Meta receiving fines worth over 100 billion KRW from the Personal Information Protection Commission for collecting personal data without user consent and using it for targeted advertising, civic groups have demanded further investigation, stating that "there remain unresolved issues regarding personal information violations that were not addressed in the previous sanctions."

On the 8th, organizations including the Citizens' Coalition for Economic Justice, Lawyers for a Democratic Society, and People's Solidarity for Participatory Democracy reported to the Personal Information Protection Commission that Meta and Google violated the Personal Information Protection Act by collecting user behavioral data such as website and app usage records without user consent for targeted advertising purposes and providing this data to third-party ad tech companies.

These groups explained that when the Personal Information Protection Commission imposed fines worth over 100 billion KRW on Google and Meta last September, issues such as whether collecting user behavioral data through tracking devices like cookies without consent was lawful, and privacy violations in the online auction process for targeted advertising, were not addressed.

The groups claimed that although Google and Meta stated they do not sell or share users' personal information with advertisers, this is false. They explained that sharing user identifiers, mobile device advertising IDs, IP addresses, along with user preferences and interests with advertisers for personalized advertising also constitutes personal information.

In particular, they argued that additional personal information leaks occurred during the auction process of user data for personalized advertising. They pointed out that during real-time auctions conducted to display personalized ads while users browse websites or apps, user personal information was shared not only with the winning advertisers but also with hundreds of companies that did not win the bids. This, they claim, is a clear violation of the Personal Information Protection Act.

Meanwhile, the Personal Information Protection Commission imposed fines of 62.9 billion KRW on Google and 30.8 billion KRW on Meta last September for violations of personal information protection laws. Since February of last year, the commission has been inspecting the collection and use of behavioral data by major online personalized advertising platforms for over a year. The investigation found that Google and Meta collected behavioral data from all devices logged into Google, Facebook, and Instagram accounts, but the consent procedures were cleverly circumvented. Google violated the law for about six years from at least 2016 to the present, and Meta for about four years from 2018 to the present.

Furthermore, the Personal Information Protection Commission issued corrective orders to Google and Meta, requiring them to notify users clearly and obtain consent so that users can easily and clearly recognize and freely exercise their decision-making rights when collecting and using behavioral data from other companies.